High computation power, algorithmic improvements in the energy-saving technique for computation, unparalleled performance of Deep Neural Networks, and AI model compression techniques have gained reliability to use deep learning for building commercial products and services. However, the security and integrity of any production-level service is always a major concern.

Recent research[1] reveals that the intelligence of DNN is vulnerable. Fan Yoo, Assistant Professor of the University of Central Florida along with his team has shown that DNN is possible to hack using bit flipping attacks even if it is the most efficient quantized DNN model. Exploiting the double-sided row hammer technique in DRAM, it is quite easy to flip a chain of a targeted most vulnerable bit of weights to deplete the intelligence of a neural network within a few minutes. He named it the DeepHammer technique.

In this article, I will summarize the insight of the novel DeepHammer attack. I will also put light on some basic topics that are relevant to fully understand this type of attack.

## The weak zone of Deep Neural Network

If you are a machine learning enthusiast, you might hear about Neural Network where there are an input layer, several hidden layers, and an output layer. In each hidden layer, there is a set of neurons that takes input from previous neurons and flows the decision to the neurons of the next layer. In each neuron, an activation function(e.g: sigmoid, ReLu, Tanh, Softmax), a weight, and bias are liable to make the decision based on inputs. So, Let’s put some light on this topic to fully understand the insight of a DNN.

#### Understanding The Math Behind A Neural Network

Suppose, we have an input X which is a cat picture. A neural network should tell us if it is a cat or not a cat. The cat picture has many pixels in its color channels. We assume that the pixels in each color channel are stacked in a feature vector x. So each neuron takes this input feature vector x for making a decision. Equation of a single neuron is,

y=\sigma(w^{T}x  + b)

where,
y is the output, w is the weight, b is the bias and, σ is the sigmoid activation function.

The equation for sigmoid function looks like this,

\sigma(z)=\frac{1}{1+e^{-z}}

As you can see, the value of σ(z) is always between 0 and 1; it doesn’t matter whatever the value of z is. The value of output σ(z) directly depends on the value of z which is actually wTx + b. Input x can be any image feature but the value of weight w and bias b should be chosen in such a way that this activation function always gives output close to y=1 as a cat if it is actually a cat. This is what machine learning does in the training process. It finds the optimized values of weights and biases which have minimum losses during this process.

A bunch of neurons form a layer and take cross inputs from the input layer or from the previous layer. Multiple layers form a Neural Network. A single neuron in a layer then performs its operation like this-

#### Deep Neural Network (DNN)

When the Neural Network has multiple hidden layers l, it is called the Deep Neural Network. The whole network contains optimized weights and biases in each neuron. A deep neural visually looks like this,

However, creating a Deep Neural Network is not the end. A programmer or a human can not set the precise values of weights and biases for each neuron to the network. This is why we need to train the network with training input features(e.g: image dataset of the cat pictures) to obtain the optimized values of weights and biases.

In the process of training the network model, forward propagation and backward propagation techniques optimize the loss of accuracy using gradient descent through updating the weight and bias parameters gradually in each iteration. This is a heavy process and sometimes it may take up to months to train an efficient network. This is why developers use a pre-trained AI model for various purposes. For example, Transfer Learning is a very popular and efficient technique to train a model just by adding extra final layers to the pre-trained model.

Finally, after the completion of the training process, we assume that the network has now our tuned parameters and values to predict the desired output. We save the trained model to use it in different applications. To make the model more secure and memory efficient, current technology follows the quantization method which uses 8-bit integers instead of 32-bit floating-point.

#### What does a DeepHammer do to the DNN?

I have highlighted some lines in this section where I talked about weights and bias. This is because the DeepHammer attacks the weight parameter of the network which is the key feature of a DNN. If a significant set of the most vulnerable bit of weight can precisely be flipped, imagine how well your AI model performs in production!

This research[1] shows that almost all the updated and secured DNN models like LeNet, VGG-13, ResNet-50, AlexNet, MobileNet-V2, etc. can be compromised easily with DeepHammer.

DeepHammer attack is a kind of Rowhammer attack on DRAM such as DDR3 and DDR4 where a set of targeted memory bits are flipped in physical memory address using a precise virtual memory page templating to affect the most vulnerable targeted weights in the DNN model. I know that this sounds crazy and a little bit convoluted but I hope the next section will be helpful for you to understand the insight of the Rowhammer attack and then the DeepHammer attack.

## Rowhammer Attack and Bit Flipping

As we know, a ram consists of millions of transistors and capacitors in its memory cell. According to Moore’s Law[2], the number of transistors in IC doubles every two years. This is really good if we expect more efficient devices to be so tiny. But in the case of DRAM(Dynamic random-access memory), it faces a side-effect. Because of the high compactness of the transistors in DRAM, the charge from one cell can easily leak to the nearby memory cell and bit flipping takes place. DRAM refreshing technique is there to stop this scenario but it eventually happens in a certain condition.

#### Insight of A DRAM Bank

A RAM consists of multiple banks where each bank has bit-lines and word-lines to form rows and columns of the memory cells. Here is an insight of a part of a memory bank –

In the figure, as you can see every memory cell consists of a MOSFET and a capacitor and there are many cells in a row. A single memory cell can be accessed by activating the word-line(blue-colored lines) and bit-line(brown-colored lines). Every cell can hold information of 0 and 1 bit. Note that, RAM itself refreshes every row of memory by discharging and recharging them every 64 milliseconds. This is because if the rows keep consistency in storing the information without refreshing, the charge in the memory cells leak away, and stored data is lost eventually.

#### Row Hammering in DRAM

It seems that RAM has solid protection to keep the data safe. However, it is possible to read and write data in any cell millions of times within 64 milliseconds before refreshing. If a significant amount of hitting in the memory cell is performed within memory refreshing time (64ms), charge leakage of the capacitor may happen and can affect the nearby memory cell’s bit to flip. This means, if the nearby cell contains information 0, it will be 1; similarly if it is 1 then it will be 0. This is called bit flipping. Since we are accessing the memory excessively with a short interval of time, we can call that it is a kind of hammering. If you are more interested in this topic, I would recommend you to check this presentation by engineer Vishnu Prem on youtube and his paper[3].

However, why do we call it Rowhammering? This is because accessing a single bit ultimately requires activating the whole rows using the word-line and row buffer(A temporary memory capturing sense row). So if you want to flip a bit, you eventually need to perform an attack on the whole row. This is why it is row hammering.

Note that, RAM does not allow to directly read or write its physical memory. Programs can access a virtual memory that maps the memory addresses to the physical addresses through a page table. Page tables indicate which physical memory is occupied by which virtual memory. That’s why memory templating requires performing a rowhammer attack.

#### Types of Row Hammering

There are two types of hammering techniques-

• single-sided rowhammer manifests by accessing one row that is adjacent to the victim row
• double-sided rowhammer alternatively accesses two rows adjacent to the victim row
• one-location hammering accesses only one location in one row repeatedly to attack the target row

DeepHammer exploits the double-sided rowhammer technique to generate the most bit flips as it introduces the strongest cross-talk effect for memory cells in the target row to flip the deployed Model’s specific bits of weights to reduce the interference accuracy to a random guess. Let’s discuss the Deep Hammering technique.

## DeepHammer: How does it work?

The aim of DeepHammer is to compromise the victim’s DNN model to provide a random prediction. The attacker’s aim is to include deterministic errors in the model weights to compromise its interference accuracy to a random state by exploiting the rowhammer vulnerability in DRAM.

But how can the attacker gain knowledge of the parameters of a deployed model? Well, as the training process is typically expensive, we can assume that most of the models use publicly available pre-trained models. Even for a private model, it is possible to gain knowledge of the model parameters through various forms of information leakage attacks (e.g., power, electromagnetic, and microarchitecture side channels).

#### DRAM Bit Flip Profiling

To perform rowhammer attack, the attacker needs to find the available vulnerable bits in the memory address that are flippable. Among these flippable bits, specific bits are chosen that maps the vulnerable targeted bits of weights of the DNN model in the nearby memory. This is an offline preparation step because if you have a DRAM of your own, you can do it to find these bits in your DRAM memory. As physical memory is not directly accessible, page table profiling is important which addresses which virtual memory corresponds to which physical memory of DRAM. However, DeepHammer performs this memory templating by generating a list of physical pages together with vulnerable bit offset in the page, flip direction (1→0 or 0→1), and the probability of observing bit flip.

#### Vulnerable bit search in DNN models

The next phase of this attack is to find the vulnerable bits of weight in the DNN model. In a deep neural network, changing arbitrary multiple bits eventually can not degrade the prediction accuracy significantly. Some weights in the network model have a big impact on prediction. If these bits change, the accuracy falls down quickly.

1. In the DeepHammer process, Gradient-based Bit Ranking searches for bits of weights that have the most impact on interference.
2. Another technique named Flip-aware Bit Search identifies the most vulnerable bits that are flippable. This means, selecting vulnerable flippable bits in DRAM that satisfies the position of vulnerable bits of weights in the DNN model. This because if an attacker flips all the vulnerable bits in his DRAM to effect the DNN model, it will not eventually work; flipping the bits of weights at the wrong location in the DNN model may adversely deteriorate the attack outcome.

To enhance the success rate of relocating the target page (that has the target bit), the author further optimizes the search algorithm by prioritizing model weight bits which have a higher number of candidate physical locations.

#### Fast and precise bit flipping using rowhammer

DeepHammer uses multiple techniques to make the process fast. For fast memory messaging, per-cpu pageset kernel data structure is used. Another technique implemented named column-page-stripe to precisely map and attack the bits of weights. A technique named online memory re-templating has been proposed to swiftly correct inconsistent bit flip profiles which were scrambled after the system reboot.

## The Experimental Result of DeepHammer Attack

The experimental result in this research has shown that almost all the quantized models are vulnerable-

## How to Mitigate the Effect of DeepHammer Attack?

Even if this research shows us a way to attack your desired DNN model which is actually running in the production, it has also shown us the ways how we can possibly overcome this threat. Here are the ways that I have got from the paper –

• It has been observed that the size of the network can mitigate the influence of the DeepHammer attack. DeepHammer requires a higher number of flips as we increase its network width.
• We can selectively protect the vulnerable bit of DNN which causes the accuracy loss to a higher level. Gradient Bit Ranking is a useful way to find these vulnerable bits then those vulnerable bits are assumed to be protected by OS and labeled as bits that cannot be flipped in the round-(i+1).
• The research has also revealed that the identified bits are mostly concentrated in the first and last a few layers. So securing these vulnerable layers instead of the entire model may efficiently improve the robustness of DNN models with low overhead. Particularly, one promising solution is to selectively preload these critical model layers onto CPU caches. Therefore, even some bits are corrupted in the DRAM, it will not adversely influence the inference accuracy of the target model

#### References:

1. Fan Yao, Adnan Siraj Rakin, Deliang Fan, “DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips“. In 29th USENIX Security Symposium (USENIX Security 20) 2020 (pp. 1463–1480). USENIX Association.
2. Gustafson J.L. (2011) , Moore’s Law. In: Padua D. (eds) Encyclopedia of Parallel Computing. Springer, Boston, MA. https://doi.org/10.1007/978-0-387-09766-4_81
3. Y. Kim et al., “Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors,” 2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA), Minneapolis, MN, 2014, pp. 361-372, doi: 10.1109/ISCA.2014.6853210.